diff options
author | Kenton Groombridge <concord@gentoo.org> | 2024-05-06 16:39:41 -0400 |
---|---|---|
committer | Kenton Groombridge <concord@gentoo.org> | 2024-05-14 13:41:49 -0400 |
commit | 8271ab906f4389dae37b0470c44cdc6ab15b784d (patch) | |
tree | c6ba419825cf65cd0c077cd6ffb34669b5f9540e /policy | |
parent | container: allow system container engines to mmap runtime files (diff) | |
download | hardened-refpolicy-8271ab906f4389dae37b0470c44cdc6ab15b784d.tar.gz hardened-refpolicy-8271ab906f4389dae37b0470c44cdc6ab15b784d.tar.bz2 hardened-refpolicy-8271ab906f4389dae37b0470c44cdc6ab15b784d.zip |
container: allow containers to getcap
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
Diffstat (limited to 'policy')
-rw-r--r-- | policy/modules/services/container.te | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 9699ac36d..68aa97ae5 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -286,7 +286,7 @@ corenet_port(container_port_t) dontaudit container_domain self:capability fsetid; dontaudit container_domain self:capability2 block_suspend; allow container_domain self:cap_userns { chown dac_override dac_read_search fowner kill setgid setuid }; -allow container_domain self:process { execstack execmem getattr getsched getsession setsched setcap setpgid signal_perms }; +allow container_domain self:process { execstack execmem getattr getcap getsched getsession setsched setcap setpgid signal_perms }; allow container_domain self:dir rw_dir_perms; allow container_domain self:file create_file_perms; allow container_domain self:fifo_file manage_fifo_file_perms; |